Cerberus: The stolen data could be used to make unauthorized transactions (Representational)
A malicious software called Cerberus is stealing financial data such as credit card details by luring people with COVID-19 related information, the Central Bureau of Investigation has warned states, Union territories and agencies after receiving Interpol inputs.
"CBI alerts State/UT/Central Agencies on a malicious software threat that uses an update related to the Coronavirus pandemic," the investigation agency said in a statement.
The Trojan virus contacts smartphone users via text messages and asks to click on a link saying it will provide COVID-19 updates. When clicked, the link installs a malicious application on their phones, which extracts sensitive financial data.
"Based on inputs received from INTERPOL, the CBI has issued an alert relating to a banking Trojan known as Cerberus. This malicious software takes advantage of COVID-19 Pandemic to impersonate and send SMS using the lure of COVID-19 related content to download the embedded malicious link, which deploys its malicious app usually spread via phishing campaigns to trick users into installing it on their smartphones," agency said.
"This Trojan primarily focuses on stealing financial data such as credit card numbers. In addition, it can use overlay attacks to trick victims into providing personal information and can capture two-factor authentication details," it added.
The stolen data could be used to make unauthorized transactions from the compromised credit cards.
On April 7, the CBI's Interpol division had sent an advisory to police departments across the country, alerting about a cyber attack on hospitals and health installations.
"Cyber criminals are using ransomware to hold hospitals and medical services digitally hostage; preventing them from accessing vital files and systems until a ransom is paid," it said.
The agency had asked the police to remain vigilant.
Last month, the central government had warned the users of the Zoom video conference application, saying it was not a safe platform. The application is being widely used for personal and official interactions as people have been asked to stay at and work from home because of the coronavirus pandemic.
"Zoom is not a safe platform even for usage of individuals a detailed advisory has already been issued by CERT-India," the home ministry had said in an advisory.
The guidelines, the government had said, would prevent unauthorised entry in the conference room and even malicious activity by authorised participants on terminals of the other participants.